Digital evidence becomes key to solving crimes

Sunday

Jul 7, 2013 at 3:15 AMJul 7, 2013 at 7:32 AM

By JIM HADDADINjhaddadin@fosters.com

DOVER — When state prosecutors present their case against murder suspect Seth Mazzaglia next year, some of the most reliable evidence in the courtroom could be supplied in digital, rather than physical, form.

Cell phone records, social media accounts, computer hard drives — even an XBox gaming console — have been scrubbed for evidence as police investigate the death of University of New Hampshire student Elizabeth Marriott.

The diversity of electronic sources underscores the growing significance of digital evidence, which has become a component of homicide investigations, major felonies and countless other crimes in New Hampshire.

In the case of Hampton mother Amanda Warf, who was murdered in March, it was a text message that helped prosecutors bring charges against two of three suspects.

Last month, after a Newmarket man allegedly tried to kidnap a toddler in Maine, police received authorization from a judge to search his apartment for computer equipment that might provide useful evidence.

Even missing data has been invoked by New Hampshire prosecutors. In Mazzaglia’s case, police say they’ve uncovered evidence Mazzaglia and his girlfriend deleted information from their cell phones to conceal Marriott’s murder.

At the New Hampshire State Police forensic laboratory, experts have been working to keep pace with digital technology, which has grown smaller, faster and increasingly complex.

Two full-time analysts are assigned to process digital evidence, which now comes in the form of desktop computers, iPads, mobile phones and any number of other gadgets.

A massive computer server allows local police departments around the state to connect remotely with the crime lab, where experts are available to scour data and share the results.

Melisa Staples, assistant director of the lab, said that like physical evidence, digital evidence has to stand up to scrutiny in court. That means one of the first steps when inspecting a digital data source is to preserve its original condition. Analysts first make an exact copy of the entire contents of a hard drive or other form of data before looking for information.

Guided by search warrants, analysts can then seek out specific types of information — such as documents, web histories, texts that were sent, or chats that took place.

Local police departments can then access a secure network using passwords and pins to see the results of the forensic search. Law enforcement officers make the final determination as to whether evidence is pertinent in a given case, Staples said.

“They’re going to be the ones, ultimately, to determine for example, ‘Is the person depicted in the image of an appropriate age?’” she said.

Although the lab’s digital evidence division has been established for several years, the job has grown increasingly complex. New systems are usually accompanied by new hardware, new security and new encryption.

The number of requests for digital analysis has also increased. But one of the most significant challenges is the sheer volume of data that must now be analyzed. Even cell phones are capable of storing gigabytes of information.

“There’s typically just a lot of information to collect and then sort through,” Staples said.

Providing physical storage for devices has also been a challenge. Once the lab is done duplicating a hard drive or other device, staffers try to get it shipped back to the investigating police agency as soon as possible.

In addition to searching for raw data, digital analysts are also important in helping prosecutors prove that a specific person is responsible for accessing a piece of data — downloading an image, leaving a comment on Facebook or sending a text message, for example. In some cases, digital analysts find clues in a person’s web history, but cooperation is necessary from Facebook, Google or another large entity to get detailed records.

With the capability to search large amounts of data, the crime lab is often called upon to help in child pornography cases. In those instances, the ability to document that a particular suspect accessed illegal data is one of the lab’s most valuable assets.

“I think the majority of our cases are those types of things, where they’re looking for child porn images, and I think that’s often being looked for is not only the image on the computer, but also , can we link those images with being downloaded by a specific person,” Staples said.